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AMENDMENTS TO THE CLAIMS 

1 . (Previously presented) A method for rule-based network management, the method 
comprising the computer-implemented steps of: 

defining and storing a set of rules in one or more Rule-Based Markup Language 

("RBML") documents, wherein the one or more RBML documents include one or 
more tags defining one or more rule elements, and wherein the set of rules 
includes: 

a symptom-event rule that identifies as a symptom a particular event occurring 
within a first network in a plurality of networks; and 

a problem-diagnosis mle that defines a problem within the network as a 
coixelation between one or more symptoms; 
collecting and storing symptom-related data about one or more symptoms, wherein 

collecting and storing the symptom-related data includes monitoring the network 

for one or more network events identified in the symptom-event rule; and 
detecting a problem within the network, wherein detecting the problem includes applying 

the problem-diagnosis rule to the symptom-related data; 
receiving a request from a user to employ a particular rule in managing a second network, 

separate from the first network; and 
distributing to a device on the second network the one or more RBML documents storing 

the particular rule. 

2. (Original) A method as recited in Claim 1, the method further comprising reviewing the 
set of rules to identify and resolve a conflict between two or more rules in the set. 

3. (Original) A method as recited in Claim 1, the method further comprising storing the one 
or more RBML documents in a rule repository, wherein the rule repository includes one or more 
directories containing RBML documents. 
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4. (Original) A method as recited in Claim 1, wherein a RBML document storing the 
problem-diagnosis rule includes: 

a problem-definition tag describing a problem; and 

a correlation tag identifying the correlation between one or more symptoms, wherein the 
one or more symptoms are defined in one or more symptom tags that include one 
or more pre-defined indicators associated with the one or more symptoms. 

5. (Original) A method as recited in Claim 4, wherein the step of detecting a problem within 
the network further comprises the steps of: 

comparing the symptom-related data to the one or more pre-defined indicators associated 
with a particular symptom to determine whether the particular symptom exists in 
the symptom-related data; 

repeating the step of comparing the symptom-related data for all symptoms identified in 
the correlation tag of the RBML document storing the problem-diagnosis rule; 
and 

only if all symptoms identified in the correlation tag exist, determining that the problem 
identified in the problem-definition tag is detected. 

6. (Original) A method as recited in Claim 1, wherein a RBML document storing the 
symptom-event rule includes: 

an event tag identifying the particular event occurring on the network; and 

a symptom tag identifying a symptom as a generalized abstraction of the particular event. 

7. (Original) A method as recited in Claim 6, wherein the RBML document storing the 
symptom-event rule further includes: 

a profile tag identifying a paiticular network device; and 

a command tag identifying a data-collection command, wherein the data-collection 
command, when executed on the particular network device, returns symptom- 
related data associated with the particular network device. 
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8. (Original) A method as recited in Claim 1, wherein: 

the set of rules further includes a problem-correction rule defining one or more corrective 
actions capable of correcting the problem within the network; and 

the method further comprises the step of recommending to a user one or more corrective 
actions defined in a RBML document storing the problem-correction rule. 

9. (Original) A method as recited in Claim 8, the method further comprising the step of 
applying to a network device, without user intervention, one or more corrective actions 
defined in the problem-correction rule. 

10. (Canceled) 

11. (Previously presented A method for defining a Rule-Based Markup Language ("RBML") 
to describe a set of rules for managing a first network among a plurality of networks, the method 
comprising the computer-implemented steps of: 

creating one or more RBML documents for storing the set of rules, wherein the one or 
more RBML documents include one or more tags defining one or more rule 
elements, and wherein: 

a RBML document storing a symptom-event rule from the set of rules includes: 

an event tag identifying a particular event occumng on the network; and 
a symptom tag identifying a symptom as a generalized abstraction of the 
particular event; and 
a RBML document storing a problem-diagnosis rule from the set of rules 
includes: 

a problem-definition tag describing a problem; and 
a correlation tag identifying a correlation between one or more symptoms, 
wherein the one or more symptoms are defined in one or more 
symptom tags that include one or more pre-defined indicators 
associated with the one or more symptoms; and 
generating, from information stored in one or more tags of the one or more RBML 
documents, one or more sequences of instructions, which instructions, when 
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executed by one or more processors, cause the one or more processors to carry out 
the steps of: 

collecting and storing symptom-related data about one or more symptoms, 
wherein collecting and storing the symptom-related data includes 
monitoring the network for one or more network events identified in the 
symptom-event mle; and 

detecting a problem within the network, wherein detecting the problem includes 
applying the problem-diagnosis mle to the symptom-related data; 

receiving a request from a user to employ a particular rule in managing a second 
network, separate from the first network; and 

distributing to a device on the second network the one or more RBML documents 
storing the particular rule. 

12. (Original) A method as recited in Claim 11, wherein the step of detecting a problem 
within the network further comprises the steps of: 

comparing the symptom- related data to the one or more pre-defined indicators associated 

with the one or more symptoms to determine whether a particular symptom exists 

in the symptom-related data; 
repeating the step of comparing the symptom-related data for all symptoms identified in 

the correlation tag of the RBML document storing the problem-diagnosis rule; 

and 

only if all symptoms identified in the correlation tag exist, determining that the problem 
identified in the problem-definition tag is detected. 

13. (Original) A method as recited in Claim 11, wherein the RBML document storing the 
symptom-event rule further includes: 

a profile tag identifying a particular network device; and 

a conmiand tag identifying a data-collection command, wherein the data-collection 
command, when executed on the particular network device, returns symptom- 
related data associated with the particular network device. 

14. (Original) A method as recited in Claim 11, wherein: 
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the step of creating one or more RBML documents further includes creating a RBML 
document for storing a problem-correction rule defining one or more corrective 
actions capable of correcting the problem within the network; and 

the step of generating instructions includes generating one or more sequences of 

instructions, which instructions, when executed by the one or more processors, 
cause the one or more processors to carry out the step of recommending to a user 
the one or more corrective actions defined in the RBML document storing the 
problem-correction rule. 

(Currently amended) An apparatus for rule-based network management, comprising: 
a rule editor for creating and storing, in one or more Rule-Based Markup Language 
("RBML") documents containing one or more tags, a set of rules employed in 
managing a first network among a plurality of networks, wherein the set of rules 
includes: 

a symptom-event rule that identifies as a symptom a particular event occurring 

within the network; and 
a problem-diagnosis rule that defines a problem within the network as a 

correlation between one or more symptoms; 
one or more processors; 

a diagnosis engine including one or more stored sequences of instructions which, when 

executed by the one or more processors, cause the one or more processors to carry 
out the steps of: 

collecting and storing symptom-related data about one or more symptoms, 
wherein collecting and storing the symptom-related data includes 
monitoring the network for one or more network events identified in the 
symptom-event rule; and 

detecting a problem within the network, wherein detecting the problem includes 
applying the problem-diagnosis rule to the symptom-related data; 
a rule broker configured to receive a request from a user to apply a particular rule in 

managing a second network, separate from the first network, and to distribute to a 

device on the second network the one or more RBML documents storing the 

particular-^ale T rule; 
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receiving a request from a user to employ a particular rule in managing a second 

network, separate from the first network; and 
distributing to a device on the second network the one or more RBML documents 

storing the particular rule. 

16. (Original) An apparatus as recited in Claim 15, wherein the rule editor is capable of 
providing to a user means for reviewing the set of rules to identify and resolve a conflict 
between two or more rules in the set. 

17. (Original) An apparatus as recited in Claim 15, wherein: 

the problem-diagnosis rule defining the correlation between one or more symptoms 
includes one or more pre-defined indicators associated with the one or more 
symptoms; and 

the diagnosis engine instructions for carrying out the step of detecting a problem within 
the network further include instmctions for carrying out the steps of: 
comparing the symptom-related data to the one or more pre-defined indicators 

associated with the one or more symptoms to determine whether a 

particular symptom exists in the symptom-related data; 
repeating the step of comparing the symptom-related data for all symptoms 

identified in the problem-diagnosis rule; and 
only if all correlated symptoms identified in the problem-diagnosis rule exist, 

determining that the problem defined in the problem-diagnosis rule is 

detected. 

18. (Original) An apparatus as recited in Claim 15, wherein the symptom-event rule further 
includes: 

information identifying a particular network device; and 

a data-collection command, wherein the data-collection command, when executed on the 
particular network device, returns symptom-related data associated with the 
particular network device. 
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19. (Original) An apparatus as recited in Claim 15, wherein: 

the set of rules further includes a problem-correction rule defining one or more corrective 
actions capable of correcting the problem within the network; and 

the diagnosis engine further includes instructions which, when executed by the one or 
more processors, cause the one or more processors to carry out the step of 
recommending to a user one or more corrective actions defined in the problem- 
correction rule. 

20. (Original) An apparatus as recited in Claim 19, wherein the diagnosis engine further 
includes instructions which, when executed by the one or more processors, cause the one or more 
processors to carry out the step of applying to a network device, without user intervention, one or 
more corrective actions defined in the problem-correction rule. 

21. (Canceled) 

22. (Previously presented) A computer-readable storage medium carrying one or more 
sequences of instructions for rule-based network management, which instructions, when 
executed by one or more processors, cause the one or more processors to carry out the steps of: 

defining and storing a set of rules in one or more Rule-Based Markup Language 

("RBML") documents, wherein the one or more RBML documents include one or 
more tags defining one or more rule elements, and wherein the set of rules 
includes: 

a symptom-event rule that identifies as a symptom a particular event occurring 

within a first network among a plurality of networks; and 
a problem-diagnosis rule that defines a problem within the network as a 
correlation between one or more symptoms; 
collecting and storing symptom-related data about one or more symptoms, wherein 

collecting and storing the symptom-related data includes monitoring the network 
for one or more network events identified in the symptom-event rule; and 
detecting a problem within the network, wherein detecting the problem includes applying 
the problem-diagnosis rule to the symptom-related data; 
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receiving a request from a user to employ a particular rule in managing a second network, 

separate from the first network; 
distributing to a device on the second network the one or more RBML documents storing 

the particular rule. 



23. (Previously presented) A computer-readable storage medium as recited in Claim 22, 
further comprising instructions which, when executed by the one or more processors, 
cause the one or more processors to carry out the step of reviewing the set of rules to 
identify and resolve a conflict between two or more rules in the set. 



24. (Previously presented) A computer-readable storage medium as recited in Claim 22, 
further comprising instmctions which, when executed by the one or more processors, 
cause the one or more processors to carry out the step of storing the one or more RBML 
documents in a rule repository, wherein the rule repository includes one or more 
directories containing RBML documents. 



25. (Previously presented) A computer-readable storage medium as recited in Claim 22, 
wherein a RBML document storing the problem-diagnosis rule includes: 

a problem-definition tag describing a problem; and 

a correlation tag identifying the correlation between one or more symptoms, wherein the 
one or more symptoms are defined in one or more symptom tags that include one 
or more pre-defined indicators associated with the one or more symptoms. 

26. (Previously presented) A computer-readable storage medium as recited in Claim 25, 
further comprising instructions which, when executed by the one or more processors, 
cause the one or more processors to carry out the steps of: 

comparing the symptom-related data to the one or more pre-defined indicators associated 
with a particular symptom to determine whether the particular symptom exists in 
the symptom-related data; 
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repeating the step of comparing the symptom-related data for all symptoms identified in 
the correlation tag of the RBML document storing the problem-diagnosis rule; 
and 

only if all symptoms identified in the correlation tag exist, determining that the problem 
identified in the problem-definition tag is detected 

27. (Previously presented) A computer-readable storage medium as recited in Claim 22, 
wherein a RBML document storing the symptom-event rule includes: 
an event tag identifying the particular event occurring on the network; and 
a symptom tag identifying a symptom as a generalized abstraction of the particular event. 

28. (Previously presented) A computer-readable storage medium as recited in Claim 27, 
wherein the RBML document storing the symptom-event rule further includes: 
a profile tag identifying a particular network device; and 

a command tag identifying a data-collection command, wherein the data-collection 

command, when executed on the particular network device, returns symptom- 
related data associated with the particular network device. 

29. (Previously presented) A computer-readable storage medium as recited in Claim 22, 
wherein: 

the set of rules further includes a problem-correction rule defining one or more corrective 
actions capable of correcting the problem within the network; and 

the computer-readable medium further comprises instructions which, when executed by 
the one or more processors, cause the one or more processors to carry out the step 
of recommending to a user one or more corrective actions defined in a RBML 
document storing the problem-correction rule. 

30. (Previously presented) A computer-readable storage medium as recited in Claim 29, 
further comprising instructions which, when executed by the one or more processors, 
cause the one or more processors to carry out the step of applying to a network device, 
without user intervention, one or more corrective actions defined in the problem- 
correction rule. 
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31. (Canceled) 

32. (Previously presented) A computer-readable storage medium carrying one or more 
sequences of instructions for defining a Rule-Based Markup Language ("RBML") to 
describe a set of rules for managing a fii'st network among a plurality of networks, which 
instructions, when executed by one or more processors, cause the one or more processors 
to carry out the steps of: 

creating one or more RBML documents for storing the set of rules, wherein the one or 
more RBML documents include one or more tags defining one or more rule 
elements, and wherein: 

a RBML document storing a symptom-event rule from the set of rules includes: 
an event tag identifying a particular event occurring on the network; and 
a symptom tag identifying a symptom as a generalized abstraction of the 
particular event; and 

a RBML document storing a problem-diagnosis rule from the set of rules 
includes: 

a problem-definition tag describing a problem; and 
a correlation tag identifying a correlation between one or more symptoms, 
wherein the one or more symptoms are defined in one or more 
symptom tags that include one or more pre-defined indicators 
associated with the one or more symptoms; and 
generating, from infoimation stored in one or more tags of the one or more RBML 
documents, one or more sequences of instructions, which instructions, when 
executed by one or more processors, cause the one or more processors to carry out 
the steps of: 

collecting and storing symptom-related data about one or more symptoms, 
wherein collecting and storing the symptom-related data includes 
monitoring the network for one or more network events identified in the 
symptom-event rule; and 

detecting a problem within the network, wherein detecting the problem includes 
applying the problem-diagnosis rule to the symptom-related data; 
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receiving a request from a user to employ a particular rule in managing a second 

network, separate from the first network; and 
distributing to a device on the second network the one or more RBML documents 

storing the particular rule. 

33. (Previously presented) A computer-readable storage medium as recited in Claim 32, 
wherein the instructions for detecting a problem within the network further comprise 
instructions for carrying out the steps of: 

comparing the symptom-related data to the one or more pre-defined indicators associated 

with the one or more symptoms to determine whether a particular symptom exists 

in the symptom-related data; 
repeating the step of comparing the symptom-related data for all symptoms identified in 

the correlation tag of the RBML document storing the problem-diagnosis rule; 

and 

only if all symptoms identified in the coiTclation tag exist, determining that the problem 
identified in the problem-definition tag is detected. 

34. (Previously presented) A computer-readable storage medium as recited in Claim 32, 
wherein the RBML document storing the symptom-event rule further includes: 

a profile tag identifying a particular network device; and 

a command tag identifying a data-collection command, wherein the data-collection 

command, when executed on the particular network device, returns symptom- 
related data associated with the particular network device. 

35. (Previously presented) A computer-readable storage medium as recited in Claim 32, 
wherein: 

the instructions for creating one or more RBML documents further comprise instructions 
for carrying out the step of creating a RBML document for storing a problem- 
correction rule defining one or more corrective actions capable of correcting the 
problem within the network; and 



CPOL 185311 



12 



Ser. No. 10/714,158 filed 11/13/2003 
Sinclair et al. - GAU 2153 (Mouzan) 
Docket No. 50325-0811 

the instractions for generating one or more sequences of instructions, by using 

information stored in one or more tags of one or more RBML documents, further 
comprise instructions for carrying out the step of recommending to a user the one 
or more corrective actions defined in the RBML document storing the problem- 
correction rule. 
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